Threat modeling (STRIDE, DREAD) in Cybersecurity - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to identify the STRIDE category for spoofing attacks.

Cybersecurity

threat_category = "[1]"  # STRIDE category for pretending to be someone else

Drag options to blanks, or click blank then click option'

ARepudiation

BTampering

CElevation of Privilege

DSpoofing

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing spoofing with tampering or repudiation.

Choosing elevation of privilege instead of spoofing.

Spoofing means pretending to be someone else to gain unauthorized access. It is one of the STRIDE threat categories.

2fill in blank

medium

Complete the code to calculate the DREAD risk score by summing the components.

Cybersecurity

risk_score = damage_potential + reproducibility + exploitability + affected_users + discoverability
average_risk = risk_score / [1]  # Number of DREAD factors

Drag options to blanks, or click blank then click option'

A4

B5

C3

D6

Attempts:

3 left

💡 Hint

Common Mistakes

Using 4 or 6 instead of 5 as the divisor.

Forgetting to divide by the number of factors.

DREAD has 5 factors: Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability. The average risk divides the total by 5.

3fill in blank

hard

Fix the error in the STRIDE threat identification code.

Cybersecurity

if threat == "[1]":
    print("This threat involves unauthorized data changes.")

Drag options to blanks, or click blank then click option'

ATampering

BDenial of Service

CRepudiation

DSpoofing

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing spoofing or repudiation which do not mean data changes.

Using Denial of Service which is about availability.

Tampering refers to unauthorized modification of data or code. The code checks for tampering to print the correct message.

4fill in blank

hard

Fill both blanks to complete the DREAD risk calculation for a threat with given scores.

Cybersecurity

total_score = [1] + [2] + exploitability + affected_users + discoverability
average_score = total_score / 5

Drag options to blanks, or click blank then click option'

Adamage_potential

Breproducibility

Cspoofing

Dtampering

Attempts:

3 left

💡 Hint

Common Mistakes

Using STRIDE categories instead of DREAD factors.

Mixing threat types with risk factors.

The DREAD risk score sums damage potential and reproducibility along with other factors. Spoofing and tampering are STRIDE categories, not DREAD factors.

5fill in blank

hard

Fill all three blanks to create a dictionary mapping STRIDE categories to their descriptions.

Cybersecurity

stride_dict = {
    "S": "[1]",
    "T": "[2]",
    "R": "[3]"
}

Drag options to blanks, or click blank then click option'

ASpoofing - pretending to be someone else

BTampering - unauthorized data modification

CRepudiation - denying actions taken

DDenial of Service - making services unavailable

Attempts:

3 left

💡 Hint

Common Mistakes

Using Denial of Service for S, T, or R keys.

Mixing descriptions between categories.

STRIDE categories S, T, and R stand for Spoofing, Tampering, and Repudiation respectively, with their common descriptions.